An information disclosure vulnerability in SAP that was patched in September impacts more than 900 SAP systems that are exposed to the Internet.
According to the expert Sergiu Popa from Quenta Solutions who reported the vulnerability, the flaw could be exploited by a remote attacker to obtain the list of SAP users from the vulnerable system. An attacker can trigger the flaw to obtain users’ data, including usernames, user IDs and emails, all information that could be used to launch spear phishing attacks and power spam campaign.
